The ID number matched. The person holding it was someone else. How to verify a South African ID.

The file looks fine. A South African ID number, a name that agrees with the record, a photo of a card. Account opened.

Then the account starts moving money it should not, and someone asks the awkward question. Was the person who opened it the person the ID belongs to? Nothing in the file says so.

This guide covers the two South African identity documents, what the ID number tells you, what the Financial Intelligence Centre Act (FICA) expects, the ways to verify, and where each one stops, Toden included.

The green ID book and the smart ID card

South African identity documents are issued by the Department of Home Affairs. Its identity documents page (opens in a new tab) says they go to South African citizens and permanent residence permit holders from the age of 16. Two formats are in circulation: the older green barcoded ID book and the smart ID card.

The government's smart ID card roll-out page (opens in a new tab) says the card began replacing the green book on 18 July 2013, with the aim of phasing the book out. It describes a polycarbonate card with holograms, laser engraving and a chip holding fingerprint and biographic data.

The Identification Act 68 of 1997 (opens in a new tab) limits what an identity card may carry (section 14): the identity number, names, gender, date and place of birth, citizenship particulars, a photograph and the prescribed fingerprints.

On the pages we opened, we found no dated Home Affairs notice setting a day on which the green book stops being accepted. Check the Department's current position before your policy refuses it.

What the ID number encodes

Section 7 of the Identification Act says the identity number is made up of figures and reproduces, in code, only two things about the person: their date of birth and gender, and whether or not they are a South African citizen. The rest is a serial, index and control number.

So you can compare the number with the date of birth the customer gives you, and a disagreement is a cheap, early signal. But the number is not a secret. Anyone who has seen an ID can type it. The exact layout of the digits is set by regulation, which we could not open, so we do not describe it here.

What FICA expects of an accountable institution

The current guidance, as of October 2026, is the Financial Intelligence Centre's Guidance Note 7B (opens in a new tab), issued on 3 August 2026. The FIC's web notice (opens in a new tab) describes it as an update to Revised Guidance Note 7A. If your policy still cites the 2017 Guidance Note 7, it cites a superseded document.

On verifying a natural person, it says:

• Section 21 of the FIC Act requires an institution to establish and verify a client's identity when it starts a business relationship or enters into a single transaction (paragraph 82). A single transaction is one of R5,000 or more outside a business relationship (paragraph 79).

• The old prescriptive steps are gone. The institution chooses what information it collects and how it verifies it, in line with the assessed risk, and describes that in its Risk Management and Compliance Programme (paragraphs 74 and 84).

• Full names, date of birth and, for a South African citizen or resident, the identity number are expected to be used every time (paragraph 85).

• Verification must use a reliable and independent third-party source and, as far as possible, the original source. Information created by the client does not count (paragraph 87).

• Government sources, including South African identity documents and the databases behind them, give a high level of confidence and should be used as far as practicable (paragraph 88). Records of the Department of Home Affairs are named as an example (paragraph 94).

• Using an electronic data source does not move the responsibility (paragraph 90).

Records of what you obtained to verify identity must be kept for at least five years from the date the business relationship ends (paragraphs 165 and 175).

Three ways to verify, and what each proves

• The Home Affairs record. Checking the number against the government record tells you the identity exists and whether the name agrees. It does not tell you who is on the other side of the screen.

• The document itself. A capture of the ID lets you compare the printed details with what was typed. A good forgery, or a genuine ID in the wrong hands, passes.

• A face match with liveness. Comparing a live selfie with a photo of the holder ties a person to the identity. A photo held by the issuer is strong evidence. The photo printed on the document is only as trustworthy as the document.

Our guide to document checks versus government database checks goes deeper on the trade-offs.

The mistakes that let fake or borrowed IDs through

• Treating a valid number as a verified person. The number confirms an identity exists. Borrowed and stolen IDs have valid numbers.

• Trusting a printed-photo match as if it were a record match. A forger controls the photo on a forged document. Send these matches to a reviewer when the risk is higher.

• A selfie with no liveness. Without it, a photo of a photo can stand in for the customer.

• No written reason for the method. FICA lets you choose. It also expects the choice, and how it tightens with risk, to be in your programme.

How Toden handles a South African ID, and where it stops

South Africa is one of five markets where Toden checks an ID against the source government database.

• The ID type is national-id with country ZA. It is a document ID, captured front and back, and the number is 13 digits.

• The details are checked against the government record. A number the record does not hold returns identity_not_found, and details that disagree with the record return gov_data_mismatch.

• A pass reaches the gov_db assurance level. Our piece on KYC assurance levels explains how to route on it.

Now the limits, stated as limits.

• No government-photo face match. For a South African ID, Toden does not compare the selfie with a photo held on the government record today.

• No chip read. The smart ID card's chip uses a proprietary application, not the passport standard, so it is not read and the chip assurance level is out of reach. South Africa does not issue chipped passports yet either.

• The fallback is the printed photo. A workflow can switch on a match between the selfie and the photo printed on the document. The result's facialMatchSource is then document. It is weaker evidence and never raises the assurance level. See setting face match thresholds.

What that means for you: a pass tells you the identity is real and that a person resembling the document's photo was present. For higher-risk customers, add a control that does not depend on the document, such as a reviewer for printed-photo matches or closer monitoring of early transactions. Your risk policy stays yours.

POPIA: the selfie is special personal information

The Protection of Personal Information Act 4 of 2013 (opens in a new tab) (POPIA), overseen by the Information Regulator, applies to all of this. Section 26 lists biometric information among the categories of special personal information that may not be processed unless section 27 allows it, for example with the person's consent or where processing is necessary to establish, exercise or defend a right or obligation in law. Decide which ground you rely on and record it.

• Notice (section 18). Tell people what you collect, why, and which law requires it.

• Retention (section 14). Keep records no longer than the purpose needs, unless a law requires longer. FICA's five-year rule is such a law.

• Operators and transfers (sections 21 and 72). Bind any provider that processes for you with a written contract, and check the grounds for sending data out of South Africa.

Our overview of biometric data under African data protection law sets South Africa beside its neighbours.

This is not legal advice

This guide summarises public sources as we read them in October 2026. Rules change, and how they apply depends on your licence and products. Read the Act and the guidance yourself and speak to counsel in South Africa before relying on it.

Want to see a South African ID check end to end? Open a Toden workspace (opens in a new tab) and run one in the sandbox, or see KYC coverage by country.